Re: [PATCH nf-next,v2] netfilter: nft_meta: add double-tagged vlan and pppoe support

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Mon, Mar 23, 2026 at 06:55:50PM +0100, Pablo Neira Ayuso wrote:
> On Sun, Mar 22, 2026 at 11:51:47PM +0100, Pablo Neira Ayuso wrote:
> > Currently:
> > 
> >   add rule netdev x y ip saddr 1.1.1.1
> > 
> > does not work with neither double-tagged vlan nor pppoe packets. This is
> > because the network and transport header offset are not pointing to the
> > IP and transport protocol headers in the stack.
> > 
> > This patch expands NFT_META_PROTOCOL and NFT_META_L4PROTO to parse
> > double-tagged vlan and pppoe packets so matching network and transport
> > header fields becomes possible with the existing userspace generated
> > bytecode. Note that this parser only supports double-tagged vlan which
> > is composed of vlan offload + vlan header in the skb payload area for
> > simplicity.
> > 
> > NFT_META_PROTOCOL is used by bridge and netdev family as an implicit
> > dependency in the bytecode to match on network header fields.
> > Similarly, there is also NFT_META_L4PROTO, which is also used as an
> > implicit dependency when matching on the transport protocol header
> > fields.
> > 
> > Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
> > ---
> > v2: - Fix typo comment "packer" -> "packet".
> >     - Add comment to clarify this support double-tagged vlan with
> >       vlan offload + vlan header in skb data area.
> >     - remove nft_meta_protocol_store() helper function.
> >     Note: IPv6 still untested here.
> 
> PPPoE with IPv4 and IPv6 is working, but there is an issue with VLAN.
> 
> I will post a v3, apologies.

No need for v3, actually this works fine/tested with:

- vlan
- pppoe
- vlan/pppoe
- vlan/vlan

testing with a simple ruleset that matches on layer 3 and 4:

table netdev x {
        chain y {
                type filter hook ingress device eth0 priority 0;
                ip daddr 1.1.1.1 udp sport 12345 counter
        }
}

so let's just reinstantiate this patch in patchwork as under review.